The short answer
Confidential waste is any discarded material that identifies a person or would harm an organisation if someone else read it: client and patient records, payroll and HR files, bank details, contracts, exam papers, CVs and letters with names and addresses. It includes the hard drives, phones and USB sticks that hold the same information. It needs secure destruction, not general waste or recycling.
On this page
“Confidential waste” is not a legal category with a fixed list. It is a practical label for anything you throw away that should not be read by the wrong person. Most of it is paper, but not all.
Two kinds of confidential
There are two reasons something counts as confidential waste.
It contains personal data. Under UK GDPR, information about an identifiable living person must be kept secure, including when it is destroyed (Article 32). A name and address on an envelope is personal data. So is a payslip, a patient letter, a reference or a parents’ evening note.
It is commercially sensitive. Contracts, tenders, pricing, board papers, legal advice and product plans may contain no personal data at all, but would harm your organisation, or a client’s, if they went astray.
If it is either, treat it as confidential waste.
Common examples by sector
| Organisation | Typical confidential waste |
|---|---|
| Any office | Payslips, P60s, HR files, CVs, bank statements, invoices with personal details, printed emails |
| Solicitors | Client files, bundles, ID documents, completion statements, wills drafts, court papers |
| Accountants | Tax returns, payroll reports, bank statements, client correspondence |
| Schools | Pupil records, safeguarding notes, SEN reports, exam scripts, staff files, parent letters |
| GP and dental practices | Patient letters, referrals, prescriptions, appointment lists, clinical notes |
| Recruitment agencies | CVs, right-to-work copies, references, interview notes |
| Charities | Donor details, Gift Aid forms, beneficiary case notes |
Some of these come with their own sector rules on retention and disposal. Health and care records, for instance, have a dedicated records management code, and solicitors and accountants answer to their professional bodies. The basic approach of locked containers and secure destruction applies to all of them.
It is not only paper
Data-bearing devices are confidential waste too:
- hard drives and SSDs from old computers and servers
- laptops, tablets and phones
- USB sticks, memory cards, CDs and DVDs
- backup tapes
- the internal drives in printers and photocopiers, which can store scanned images
The NCSC’s guidance on storage media covers erasing and destroying these. They need a different process from paper, with each serial number recorded. See hard drive destruction.
Other items can also count: ID badges and access cards, uniforms with logos that could be used to gain entry, and product samples or prototypes.
What is not confidential waste
Plain paper with no information on it, marketing leaflets, newspapers and packaging can go in normal recycling. The difficulty is that sorting takes time and people get it wrong. Most organisations find it simpler to tell staff: if in doubt, it goes in the console.
Why “just recycle it” is not enough
Paper recycling is collected, baled and sorted by people and machines with no security controls. A bag of client letters in a recycling bin is a data breach once anyone looks inside. UK GDPR also says personal data should not be kept longer than necessary (Article 5), so organisations need a reliable way to destroy what they no longer need, not just a way to throw it out.
The ICO expects records with personal data to go into locked bins and be destroyed by cross-shredding or incineration, with contracts and certificates where a third party does it (ICO accountability framework).
How to handle it
- Put locked confidential waste bins or consoles where paper is created.
- Arrange regular collection and destruction by a contractor working to BS EN 15713:2023.
- Keep drives and devices separate, listed and locked.
- Clear old archives in a single one-off purge once they pass their retention dates.
- File the certificate of destruction for each collection.
Our guide on how to dispose of confidential waste covers each step, and the page on confidential waste disposal sets out the rules in full.
To get prices from a contractor that covers your postcode, use the form below.
Where our information comes from
- legislation.gov.uk: UK GDPR Article 5, principles (read 2 November 2026)
- legislation.gov.uk: UK GDPR Article 32, security of processing (read 2 November 2026)
- ICO: Accountability framework, destruction (read 2 November 2026)
- NCSC: Secure sanitisation and disposal of storage media (read 2 November 2026)